Certbot with Sectigo ACME for Apache and Nginx on Ubuntu, Debian, RHEL

On a Linux VPS or dedicated server with Apache or Nginx, Certbot can obtain a Sectigo certificate through your ACME subscription, configure HTTPS in the web server and renew the certificate automatically. You need root or sudo access, a supported and up-to-date operating system, and the ACME credentials from Sectigo ACME Certificate-as-a-Service. The steps below cover installation, the first certificate and checking renewal.

Before you start

• The domain's A record (and AAAA, if you use IPv6) points to this server; the steps for a zone at TopHost are in adding A records.
• The site already opens over HTTP, and the web server has a virtual host for it with the right name: ServerName and ServerAlias in Apache, server_name in Nginx.
• Ports 80 and 443 are open in the server firewall, for example with sudo ufw allow 80/tcp and sudo ufw allow 443/tcp on Ubuntu, or sudo firewall-cmd --permanent --add-service=http --add-service=https followed by sudo firewall-cmd --reload on AlmaLinux and Rocky Linux.
• You have the Server URL, EAB MAC ID and EAB MAC Key from the client area.

If the server runs a control panel such as CyberPanel or FastPanel, the panel manages the web server configuration itself and may overwrite changes made by Certbot. In that case use the panel's own SSL tools or the webroot method described below.

Step 1. Install Certbot

Ubuntu and Debian: from the distribution packages

sudo apt update
sudo apt install certbot python3-certbot-nginx

For Apache, install python3-certbot-apache instead of python3-certbot-nginx. This is the simplest option; the version may be somewhat older than the newest release.

Ubuntu and Debian: as a snap (the method recommended by the Certbot project)

sudo apt remove certbot
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

The first command is needed only if Certbot was previously installed from packages. The snap updates itself and already includes the Apache and Nginx plugins.

AlmaLinux, Rocky Linux and other RHEL-based systems

sudo dnf install epel-release
sudo dnf install certbot python3-certbot-nginx

For Apache, use python3-certbot-apache. On Red Hat Enterprise Linux itself, enable the EPEL repository as described in the Red Hat documentation first. Very old systems that only have yum and no longer receive updates are not a good base for Certbot; update the operating system before you begin.

Check the installation with certbot --version.

Step 2. Obtain and install the certificate

Automatic mode: Certbot configures the web server

For Nginx (replace the placeholders with your data):

sudo certbot --nginx \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_MAC_ID \
  --eab-hmac-key YOUR_EAB_MAC_KEY \
  --email admin@example.com --agree-tos --non-interactive \
  -d example.com -d www.example.com \
  --cert-name example.com --redirect

For Apache, the command is the same with --apache instead of --nginx. Certbot validates the domain over HTTP, writes the certificate to /etc/letsencrypt/live/example.com/ (Certbot uses this folder for every certificate authority, not only Let's Encrypt), adds the HTTPS settings to the virtual host and, because of --redirect, sends HTTP visitors to HTTPS.

Manual mode: you edit the configuration yourself

If you prefer to keep full control over the configuration files, obtain only the certificate with the webroot method. Certbot places the validation file in the site's folder:

sudo certbot certonly --webroot -w /var/www/example.com \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_MAC_ID --eab-hmac-key YOUR_EAB_MAC_KEY \
  --email admin@example.com --agree-tos --non-interactive \
  -d example.com -d www.example.com --cert-name example.com \
  --deploy-hook "systemctl reload nginx"

Then point the virtual host to the files. In Nginx:

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

In Apache:

SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

Test the configuration with sudo nginx -t or sudo apachectl configtest before reloading. The --deploy-hook option makes Certbot reload the web server after every renewal; for Apache, write systemctl reload apache2 (Debian, Ubuntu) or systemctl reload httpd (RHEL family).

What the options mean

Step 3. Check renewal

Both the snap and the distribution packages install a timer or cron job that runs certbot renew twice a day; certificates are renewed when they approach expiry. Useful checks:

sudo certbot certificates
systemctl list-timers | grep certbot

The first command lists the certificates, their names and expiry dates. To test a real renewal once, run sudo certbot renew --cert-name example.com --force-renewal. Do not repeat it often: each forced run issues a new certificate.

Common errors

• Could not find a matching virtual host / server block. The name passed with -d does not appear in ServerName, ServerAlias or server_name. Add it, reload the web server and try again.
• Timeout or connection refused during validation. Port 80 is closed in the firewall or the DNS record still points to another server.
• 404 for the validation file (webroot). The -w path is not the folder the site is really served from, or a rule in the configuration blocks /.well-known/acme-challenge/.
• unauthorized or external account binding errors. The EAB data or the server URL are incomplete, or a name is not in the domain list of the subscription.
• The browser still shows the old certificate. The web server was not reloaded, or another virtual host answers for the same name.

Certbot documentation: eff-certbot.readthedocs.io. If you have a managed VPS from TopHost or the steps above do not solve the problem, open a ticket with the command and the full error text, but without the EAB MAC Key.

Related articles

• Sectigo ACME Certificate-as-a-Service: order and credentials
• SSL on LiteSpeed and OpenLiteSpeed with acme.sh
• HTTPS for a Node.js application
• Connecting to the server via SSH